AnyDesk COM Printer Pipe Named Pipe Creation — CVE-2026-45115 LPE

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects multiple suspicious activities associated with the AnyDesk remote access application, including the creation of specific named pipes, execution of processes with sensitive command-line arguments (e.g., comsvcs, impersonation privileges), non-standard DLL loads by the application, and the spawning of system-level processes. These behaviors are indicative of abuse of remote access software for post-exploitation activities or privilege escalation.